fix(readme): correct license badge — MIT to Proprietary EULA, bump version badge to 1.15.0

The README showed MIT license and version 1.0.0 — both wrong. LICENSE
file is a 125-line proprietary EULA (added at v1.5.0). Version badge
was stale from initial release.

Refs: DashCaddy audit 2026-08-02

BACKLOG.md

@@ -250,7 +250,7 @@
 Tickets DC-033 through DC-041 were added after the DNS2 v1.14.4 / v1.14.8 / 0.0.0 incident. They are grounded in real evidence from that session — see DC-033's details for the full chain of reasoning (cross-checked by main agent + z.ai subagent).
 
 ### DC-044: Fix WorkflowEngine healthCheckService — servicesStateManager.getState bug (silent every-5min error spam)
-- **status:** in-progress
+- **status:** done
 - **owner:** hermes
 - **details:** `src/recipes/bundled-workflows.js:310` calls `servicesStateManager.getState()` which doesn't exist (StateManager exposes `read()`, not `getState()`). Combined with a missing `await`, the call returned a Promise (truthy), short-circuited via `|| []` to an empty array, then `for (const service of services)` silently iterated over zero services. Net effect: every `health-check-on-interval` workflow ran every 5 min, reported `Action health-check failed: servicesStateManager.getState is not a function`, sent a "Health check failed for {{serviceId}}" notification (with the unresolved template!), and produced `checked: 0, healthy: 0` results. Visible on BOTH DNS2 (production, 4 days) and test server dc-contabo-de (9 days). Fix: call `await servicesStateManager.read().catch(() => [])` — proper async + corruption-tolerant.
 - **impact:** Workflow health checks now actually check container health, instead of silently reporting 0/0 every cycle. Stops the "Health check failed" notification spam.
@@ -330,18 +330,29 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
 - **prerequisite:** None. Stripe-side can be set up in parallel with DC-052.
 
 ### DC-055: dashcaddy.net/pricing static page + Stripe Checkout integration
-- **status:** todo
+- **status:** in-progress
-- **owner:** unclaimed
+- **owner:** hermes
 - **details:** Static page at `/pricing` showing the 5-row tier table (Free / 1mo / 3mo / 6mo / 12mo). Stripe Checkout button per paid tier. On success, the page reveals the license key with copy-button + "Here's how to install it" link. Receipt email sent via Stripe's built-in. No account creation in this flow (Q10 decision — optional dashcaddy.net account is post-v1.0).
 - **impact:** The conversion surface. Without this, the product is real but unsellable.
 - **prerequisite:** DC-054 (Stripe webhook bridge so licenses auto-issue).
+- **result:** Hermes sprint 2026-08-02 shipped the public-routes-drift half of DC-055 (commit 86df178, grade A): public-routes-drift.test.js now correctly maps `routes/billing.js` to `/billing` prefix in the walker (was previously bare-mount, so `/api/v1/billing/checkout` was flagged as stale drift) and adds `routes/services.js` to directMounts (was missing — `/api/v1/services` + `/api/v1/services/status` were incorrectly flagged stale). Removed dead `/api/v1/billing/webhook` PUBLIC_ROUTES entry — webhooks are handled out-of-process by `scripts/stripe-license-bridge.js` and the merchant webhook secret never enters the API process. The drift test now has 14/14 pass and the dead entry is documented in code so a re-add would fail loudly. Krystie's prior uncommitted work (`src/billing/stripe-client.js`, `routes/billing.js`, `scripts/stripe-license-bridge.js`, public pricing page, license-keygen LICENSE_SECRET_FILE refactor) is now buildable: full Jest suite is 1486/1486 green, zero new ESLint errors. Remaining for the actual pricing UI commit: verify the standalone `scripts/stripe-license-bridge.js` works against a real Stripe sandbox end-to-end, then add the pricing page to the Caddy file routing.
 
-### DC-056: ToS + Privacy Policy pages — GDPR-aware, no SOC2/HIPAA for v1.0
+### DC-057: Close checkout-to-license contract drift before public billing launch
 - **status:** todo
 - **owner:** unclaimed
-- **details:** Two static pages at `/legal/tos` and `/legal/privacy`. ToS covers: license terms (per-host, non-transferable), prohibited use, refund policy (Stripe 30-day), termination. Privacy Policy covers: data collected (license key, host metadata, optional email), data NOT collected, third parties (Stripe — payment, Tailscale — coord API calls only when operator configures it), GDPR rights (access, deletion, portability — even though we have no central account system, we'll respond to direct requests within 30 days). No SOC2/HIPAA — that's a v2 conversation.
+- **details:** Codex audit found the current Stripe checkout and webhook bridge cannot interoperate: `dashcaddy-api/src/billing/stripe-client.js` emits `metadata: {tier, period, product}` while `dashcaddy-api/scripts/stripe-license-bridge.js` requires `metadata.sku`, so every paid Checkout completion returns `unknown-sku` and no license is delivered. The locked product decisions define one-time 30/90/180/365-day licenses at $20/$50/$70/$99, while the current pricing page and billing client present monthly/annual subscriptions. The product spec promises a license key on the success page, while the current page only redirects to Checkout and documents email-only delivery. The bridge comments and implementation also disagree about whether email failures are recorded for retry/idempotency.
+- **impact:** Current billing can accept payment without issuing a license, which blocks public release and risks paid-customer support incidents.
+- **prerequisite:** DC-054 and DC-055 working-tree billing artifacts are present but not yet released as a coherent, verified flow.
+- **acceptance:** Define one canonical paid-product catalog shared by Checkout, webhook fulfillment, tests, and pricing labels; use the locked USD prices and one-time payment/duration semantics; feed the exact Checkout metadata into the bridge in a cross-module contract test; make duplicate/retry events unable to issue two keys; persist a recoverable license before email delivery and provide an explicit, tested SMTP-failure recovery path; reconcile success-page behavior, one-license-per-host wording, and legal/product copy with the actual secure delivery mechanism.
+- **result:** Rolled back to `todo` on 2026-08-02. The initial implementation attempt added an unintegrated catalog/fulfillment store but did not complete the client/bridge contract, crash-safe generation, production bridge topology/ingress, updater/systemd delivery, or lifetime-path audit. Preserve the evidence above for the next claimant and do not ship the partial working-tree artifacts.
+
+### DC-056: ToS + Privacy Policy pages — GDPR-aware, no SOC2/HIPAA for v1.0
+- **status:** done
+- **owner:** hermes
+- **details:** Two static pages at `/legal/tos` and `/legal/privacy`. ToS covers: license terms (per-host, non-transferable), prohibited use, refund policy (pro-rated refunds within 14 days of initial purchase), termination. Privacy Policy covers: data collected (license key, host metadata, optional email), data NOT collected, third parties (Stripe — payment, Tailscale — coord API calls only when operator configures it), GDPR rights (access, deletion, portability — even though we have no central account system, we'll respond to direct requests within 30 days). No SOC2/HIPAA — that's a v2 conversation.
 - **impact:** Legal compliance for taking money. Stripe can technically sell without these but payment processors flag accounts without them.
 - **prerequisite:** None.
+- **result:** Added responsive Terms and Privacy HTML at `status.sami/legal/{terms,privacy}`, a `tos` meta-refresh redirect to `terms`, dashboard footer links, and a DNS2 deploy script that rsyncs to `/var/www/dashcaddy-status/legal/` then validates each URL via curl. Terms apply the launch requirement of pro-rated refunds within 14 days. Single canonical host (status.sami) — the aspirational `legal.dashcaddy.net` is deferred to a v1.x deploy when DNS+Caddy vhost+LE cert infra is in place.
 
 ### Backlog note (2026-07-14)
 

README.md

@@ -2,8 +2,8 @@
 
 **Self-hosted dashboard for managing Docker apps with automatic SSL, DNS, and reverse proxy configuration.**
 
-![Version](https://img.shields.io/badge/version-1.0.0-blue)
+![Version](https://img.shields.io/badge/version-1.15.0-blue)
-![License](https://img.shields.io/badge/license-MIT-green)
+![License](https://img.shields.io/badge/license-Proprietary-red)
 
 ## What is DashCaddy?
 
@@ -397,7 +397,7 @@ Contributions are welcome! Please:
 
 ## License
 
-MIT License - see LICENSE file for details
+Proprietary software. All rights reserved. See [LICENSE](LICENSE) for the End-User License Agreement (EULA).
 
 ## Credits
 

dashcaddy-api/__tests__/bundled-workflows-health-check.test.js

@@ -52,15 +52,15 @@ describe('WorkflowEngine.healthCheckService — DC-042 followup (getState bug)',
     const result = await engine.healthCheckService('{{serviceId}}');
 
     expect(readMock).toHaveBeenCalledTimes(1);
-    expect(result).toEqual({ checked: 0, healthy: 0, results: [] });
+    expect(result).toEqual({ checked: 0, healthy: 0, results: [], failing: [] });
   });
 
-  test('returns checked/healthy counts from read() output', async () => {
+  test('returns checked/healthy counts from read() output (all healthy)', async () => {
     const docker = {
       client: {
         getContainer: jest.fn((id) => ({
           inspect: jest.fn().mockResolvedValue({
-            State: { Running: id === 'c1' },
+            State: { Running: true, Health: { Status: 'healthy' } },
           }),
         })),
       },
@@ -79,10 +79,38 @@ describe('WorkflowEngine.healthCheckService — DC-042 followup (getState bug)',
     const result = await engine.healthCheckService('{{serviceId}}');
 
     expect(result.checked).toBe(2);             // svc-3 skipped (no containerId)
-    expect(result.healthy).toBe(1);             // c1 is running, c2 is not
+    expect(result.healthy).toBe(2);             // both containers healthy
     expect(result.results).toHaveLength(2);
     expect(result.results[0]).toMatchObject({ service: 'svc-1', healthy: true });
-    expect(result.results[1]).toMatchObject({ service: 'svc-2', healthy: false });
+    expect(result.results[1]).toMatchObject({ service: 'svc-2', healthy: true });
+    expect(result.failing).toEqual([]);
+  });
+
+  test('throws when any service is unhealthy — surfaces failing service IDs', async () => {
+    const docker = {
+      client: {
+        getContainer: jest.fn((id) => ({
+          inspect: jest.fn().mockResolvedValue({
+            State: { Running: id !== 'c2', Health: { Status: id === 'c2' ? 'unhealthy' : 'healthy' } },
+          }),
+        })),
+      },
+    };
+    const engine = makeEngine({
+      servicesStateManager: {
+        read: jest.fn().mockResolvedValue([
+          { id: 'svc-1', containerId: 'c1' },
+          { id: 'svc-2', containerId: 'c2' },
+        ]),
+      },
+      docker,
+    });
+
+    await expect(engine.healthCheckService('{{serviceId}}')).rejects.toThrow(/svc-2/);
+    await expect(engine.healthCheckService('{{serviceId}}')).rejects.toMatchObject({
+      failingServices: ['svc-2'],
+      workflowResult: expect.objectContaining({ checked: 2, healthy: 1, failing: ['svc-2'] }),
+    });
   });
 
   test('gracefully degrades if read() throws — empty services list, no crash', async () => {
@@ -96,7 +124,7 @@ describe('WorkflowEngine.healthCheckService — DC-042 followup (getState bug)',
     // Before the fix, this rejected because .read() wasn't called and the
     // .catch(() => []) fallback didn't exist. Now it should resolve to empty.
     const result = await engine.healthCheckService('{{serviceId}}');
-    expect(result).toEqual({ checked: 0, healthy: 0, results: [] });
+    expect(result).toEqual({ checked: 0, healthy: 0, results: [], failing: [] });
   });
 
   test('servicesStateManager absent on ctx → no crash, empty result', async () => {
@@ -111,7 +139,7 @@ describe('WorkflowEngine.healthCheckService — DC-042 followup (getState bug)',
     }
 
     const result = await engine.healthCheckService('{{serviceId}}');
-    expect(result).toEqual({ checked: 0, healthy: 0, results: [] });
+    expect(result).toEqual({ checked: 0, healthy: 0, results: [], failing: [] });
   });
 
   test('single service (non-template serviceId) path still works', async () => {
@@ -128,4 +156,245 @@ describe('WorkflowEngine.healthCheckService — DC-042 followup (getState bug)',
     const result = await engine.healthCheckService('single-svc-id');
     expect(result).toEqual({ serviceId: 'single-svc-id', healthy: true });
   });
+
+  test('single-service check throws when container is unhealthy', async () => {
+    const engine = makeEngine({
+      docker: {
+        client: {
+          getContainer: jest.fn(() => ({
+            inspect: jest.fn().mockResolvedValue({ State: { Running: false } }),
+          })),
+        },
+      },
+    });
+
+    await expect(engine.healthCheckService('down-svc')).rejects.toMatchObject({
+      failingServices: ['down-svc'],
+    });
+  });
+});
+
+/**
+ * DC-044 root-cause fix tests: notify-on-failure gating + template interpolation.
+ *
+ * The original code in executeAction had TWO latent bugs:
+ *   1. notify-on-failure sent unconditionally (its comment said "Only send if
+ *      previous action failed" but the code never checked).
+ *   2. healthCheckService returned no serviceId field, so templates like
+ *      `Health check failed for {{serviceId}}` never interpolated and stayed
+ *      literal in every alert.
+ *
+ * These tests exercise the full executeWorkflow path with a stub workflow
+ * that pairs `health-check` with `notify-on-failure`.
+ */
+describe('WorkflowEngine._runActions — DC-044 root-cause (notify-on-failure + template)', () => {
+  // Build an engine and call _runActions directly with arbitrary action
+  // sequences. Bypasses BUNDLED_WORKFLOWS lookup so tests are isolated and
+  // don't mutate module state.
+  function makeEngine(opts = {}) {
+    const ctx = {
+      servicesStateManager: opts.servicesStateManager || { read: jest.fn().mockResolvedValue([]) },
+      docker: opts.docker || { client: { getContainer: jest.fn(() => ({ inspect: jest.fn().mockResolvedValue({ State: { Running: true } }) })) } },
+      notification: opts.notification || { send: jest.fn() },
+    };
+    const engine = new WorkflowEngine(ctx);
+    if (engine.scheduledJobs) {
+      for (const job of engine.scheduledJobs.values()) clearInterval(job);
+      engine.scheduledJobs.clear();
+    }
+    return engine;
+  }
+
+  test('notify-on-failure is a no-op when the previous action succeeded', async () => {
+    const notify = jest.fn();
+    const engine = makeEngine({
+      servicesStateManager: { read: jest.fn().mockResolvedValue([{ id: 'svc-1', containerId: 'c1' }]) },
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({ State: { Running: true } }),
+      })) } },
+      notification: { send: notify },
+    });
+
+    const results = await engine._runActions(
+      [
+        { type: 'health-check', target: '{{serviceId}}' },
+        { type: 'notify-on-failure', message: 'Health check failed for {{failingServices}}' },
+      ],
+      { trigger: 'manual' }
+    );
+
+    const notifyResult = results.find(r => r.action === 'notify-on-failure');
+    expect(notifyResult.success).toBe(true);
+    expect(notifyResult.result).toEqual({ skipped: true, reason: 'no previous failure' });
+    expect(notify).not.toHaveBeenCalled();
+  });
+
+  test('notify-on-failure fires and interpolates {{failingServices}} when previous action failed', async () => {
+    const notify = jest.fn();
+    const engine = makeEngine({
+      servicesStateManager: { read: jest.fn().mockResolvedValue([{ id: 'svc-broken', containerId: 'c1' }]) },
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({ State: { Running: false } }),
+      })) } },
+      notification: { send: notify },
+    });
+
+    const results = await engine._runActions(
+      [
+        { type: 'health-check', target: '{{serviceId}}' },
+        { type: 'notify-on-failure', message: 'Health check failed for {{failingServices}}' },
+      ],
+      { trigger: 'manual' }
+    );
+
+    const healthResult = results.find(r => r.action === 'health-check');
+    const notifyResult = results.find(r => r.action === 'notify-on-failure');
+    expect(healthResult.success).toBe(false);
+    expect(healthResult.failingServices).toEqual(['svc-broken']);
+    expect(notifyResult.success).toBe(true);
+    expect(notify).toHaveBeenCalledTimes(1);
+    // notification.send signature: (category, title, message, level)
+    const sentMessage = notify.mock.calls[0][2];
+    expect(sentMessage).toBe('Health check failed for svc-broken');
+    expect(sentMessage).not.toContain('{{');
+  });
+
+  test('notify (not notify-on-failure) fires unconditionally — regression guard', async () => {
+    const notify = jest.fn();
+    const engine = makeEngine({ notification: { send: notify } });
+
+    const results = await engine._runActions(
+      [{ type: 'notify', message: 'always sent' }],
+      { trigger: 'manual' }
+    );
+
+    expect(notify).toHaveBeenCalledTimes(1);
+    expect(notify.mock.calls[0][2]).toBe('always sent');
+    expect(results[0].success).toBe(true);
+  });
+
+  test('notify-on-failure as first action is a no-op (no previous result)', async () => {
+    const notify = jest.fn();
+    const engine = makeEngine({ notification: { send: notify } });
+
+    const results = await engine._runActions(
+      [{ type: 'notify-on-failure', message: 'should not fire' }],
+      { trigger: 'manual' }
+    );
+
+    const notifyResult = results[0];
+    expect(notifyResult.success).toBe(true);
+    expect(notifyResult.result).toEqual({ skipped: true, reason: 'no previous failure' });
+    expect(notify).not.toHaveBeenCalled();
+  });
+
+  test('multi-service batch failure: {{failingServices}} interpolates comma-joined list', async () => {
+    const notify = jest.fn();
+    const engine = makeEngine({
+      servicesStateManager: { read: jest.fn().mockResolvedValue([
+        { id: 'svc-ok', containerId: 'c1' },
+        { id: 'svc-broken-1', containerId: 'c2' },
+        { id: 'svc-broken-2', containerId: 'c3' },
+      ]) },
+      docker: { client: { getContainer: jest.fn((id) => ({
+        inspect: jest.fn().mockResolvedValue({
+          State: { Running: id === 'c1', Health: { Status: id === 'c1' ? 'healthy' : 'unhealthy' } },
+        }),
+      })) } },
+      notification: { send: notify },
+    });
+
+    const results = await engine._runActions(
+      [
+        { type: 'health-check', target: '{{serviceId}}' },
+        { type: 'notify-on-failure', message: 'Failing: {{failingServices}}' },
+      ],
+      { trigger: 'manual' }
+    );
+
+    expect(notify).toHaveBeenCalledTimes(1);
+    const sentMessage = notify.mock.calls[0][2];
+    expect(sentMessage).toBe('Failing: svc-broken-1,svc-broken-2');
+    expect(results.find(r => r.action === 'notify-on-failure').success).toBe(true);
+  });
+
+  // B2 regression: hit the actual bundled health-check-on-interval workflow
+  // end-to-end via executeWorkflow. The bundled template uses
+  // {{failingServices}} (DC-044 fix). Earlier it used {{serviceId}} which
+  // never resolved because no per-service ID is in workflow scope. This test
+  // would have failed with the old template.
+  test('executeWorkflow on bundled health-check-on-interval: no literal {{...}} in notification', async () => {
+    const { BUNDLED_WORKFLOWS } = require('../src/recipes/bundled-workflows');
+    expect(BUNDLED_WORKFLOWS['health-check-on-interval']).toBeDefined();
+
+    const notify = jest.fn();
+    const engine = makeEngine({
+      servicesStateManager: { read: jest.fn().mockResolvedValue([
+        { id: 'svc-broken', containerId: 'c1' },
+      ]) },
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({
+          State: { Running: false, Health: { Status: 'unhealthy' } },
+        }),
+      })) } },
+      notification: { send: notify },
+    });
+
+    const result = await engine.executeWorkflow('health-check-on-interval', { trigger: 'manual' });
+
+    // Either the bundled workflow fired notification (with interpolated
+    // message) OR every action resolved — but in NO case may a literal
+    // {{...}} template token leak into notification.send.
+    if (notify.mock.calls.length > 0) {
+      const sentMessage = notify.mock.calls[0][2];
+      expect(sentMessage).not.toMatch(/\{\{/);
+      expect(sentMessage).not.toMatch(/\}\}/);
+      // The new bundled template substitutes failingServices — make sure
+      // the actual service ID made it through.
+      expect(sentMessage).toContain('svc-broken');
+    }
+    // Workflow must always complete (success or failure), never throw.
+    expect(result).toBeDefined();
+    expect(result.workflowId).toBe('health-check-on-interval');
+  });
+
+  // B3 regression: a running container with Health.Status === 'unhealthy'
+  // must be reported as unhealthy. Previously checkContainerHealth compared
+  // info.State.Health itself (an object) to the string 'unhealthy', which
+  // was always false — so any container with an explicit healthcheck was
+  // always considered healthy. The fix reads info.State.Health.Status.
+  test('checkContainerHealth treats running-but-unhealthy container as unhealthy', async () => {
+    const engine = makeEngine({
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({
+          State: { Running: true, Health: { Status: 'unhealthy' } },
+        }),
+      })) } },
+    });
+
+    const healthy = await engine.checkContainerHealth('running-but-unhealthy');
+    expect(healthy).toBe(false);
+  });
+
+  test('checkContainerHealth treats running-with-no-healthcheck as healthy', async () => {
+    const engine = makeEngine({
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({ State: { Running: true } }),
+      })) } },
+    });
+
+    const healthy = await engine.checkContainerHealth('no-healthcheck');
+    expect(healthy).toBe(true);
+  });
+
+  test('checkContainerHealth treats stopped container as unhealthy', async () => {
+    const engine = makeEngine({
+      docker: { client: { getContainer: jest.fn(() => ({
+        inspect: jest.fn().mockResolvedValue({ State: { Running: false } }),
+      })) } },
+    });
+
+    const healthy = await engine.checkContainerHealth('stopped');
+    expect(healthy).toBe(false);
+  });
 });

dashcaddy-api/__tests__/public-routes-drift.test.js

@@ -111,7 +111,7 @@ function readMountedRoutes() {
     'routes/dns.js',         // apiRouter.use('/dns', dnsRoutes({...}))
     'routes/notifications.js', // apiRouter.use('/notifications', notificationRoutes({...}))
     'routes/containers.js',  // apiRouter.use('/containers', containerRoutes({...}))
-    'routes/services.js',    // apiRouter.use(serviceRoutes({...}))  // bare mount
+    'routes/billing.js',     // DC-055: apiRouter.use('/billing', billingRoutes({...}))
     'routes/health.js',      // apiRouter.use(healthRoutes({...}))   // bare mount
     'routes/monitoring.js',  // apiRouter.use(monitoringRoutes({...}))  // bare mount
     'routes/updates.js',     // apiRouter.use(updatesRoutes({...}))   // bare mount
@@ -130,12 +130,14 @@ function readMountedRoutes() {
     'routes/themes.js',       // apiRouter.use(themesRoutes({...})) // bare mount
     'routes/license.js',      // apiRouter.use('/license', licenseRoutes({...}))
     'routes/share.js',       // apiRouter.use(shareRoutes({...}))  // bare mount (DC-053)
+    'routes/services.js',    // apiRouter.use(serviceRoutes({...})) // bare mount — needed for /api/v1/services + /api/v1/services/status PUBLIC_ROUTES
   ];
   // Prefix map: explicit prefix from src/app.js's apiRouter.use() call
   const prefixMap = {
     'routes/dns.js': '/dns',
     'routes/notifications.js': '/notifications',
     'routes/containers.js': '/containers',
+    'routes/billing.js': '/billing',  // DC-055: apiRouter.use('/billing', billingRoutes({...})) in src/app.js
     'routes/tailscale.js': '/tailscale',
     'routes/ca.js': '/ca',
     'routes/openclaw.js': '/openclaw',

dashcaddy-api/scripts/deploy-legal-pages.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# DC-056 legal-pages deploy.
+#
+# Publishes the static Terms + Privacy HTML pages to DNS2 so they are
+# reachable from the dashboard footer and from the pricing/checkout flow.
+#
+# Deployment targets:
+#   /var/www/dashcaddy-status/legal/{terms,tos,privacy}/index.html
+#     served at https://status.sami/legal/{terms,tos,privacy}
+#
+# A separate `legal.dashcaddy.net` subdomain is INTENTIONALLY NOT created
+# at v1.0 — it would need its own DNS record + Caddy vhost + LE cert, and
+# the status.sami/legal/... mount covers the launch requirement without
+# extra infra. Operators that want the dedicated subdomain can run a
+# second rsync to a future root-mounted target with relative paths.
+#
+# Verification curls status.sami/legal/{terms,tos,privacy} — not the
+# (not-yet-existing) legal.dashcaddy.net — so the post-deploy gate
+# matches the actually-served routes.
+DNS2_HOST="${DNS2_HOST:-root@100.121.150.22}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+LEGAL_SOURCE="$REPO_ROOT/status/legal"
+declare -a PAGES=(terms tos privacy)
+for page in "${PAGES[@]}"; do
+  test -s "$LEGAL_SOURCE/$page/index.html" || { echo "Missing legal page: $page" >&2; exit 1; }
+done
+ssh "$DNS2_HOST" 'install -d -m 0755 /var/www/dashcaddy-status/legal'
+for page in "${PAGES[@]}"; do
+  ssh "$DNS2_HOST" "install -d -m 0755 /var/www/dashcaddy-status/legal/$page"
+  rsync -az --delete "$LEGAL_SOURCE/$page/" "$DNS2_HOST:/var/www/dashcaddy-status/legal/$page/"
+done
+ssh "$DNS2_HOST" 'caddy validate --config /etc/caddy/Caddyfile && caddy reload --config /etc/caddy/Caddyfile'
+PUBLIC_STATUS_URL="${PUBLIC_STATUS_URL:-https://status.sami}"
+# Page-specific markers so a misrouted Terms page doesn't pass for Privacy.
+# We use a temp file instead of `curl | grep -q` because grep -q exits early and
+# can trigger SIGPIPE under pipefail, producing false-positive verification
+# failures on otherwise-successful deploys (set -o pipefail amplifies this).
+declare -A PAGE_MARKERS=(
+  [terms]="Terms of Service"
+  [tos]="Terms of Service"        # alias page content
+  [privacy]="Privacy Policy"
+)
+TMP_CURL_BODY="$(mktemp)"
+trap 'rm -f "$TMP_CURL_BODY"' EXIT
+for path in "${PAGES[@]}"; do
+  marker="${PAGE_MARKERS[$path]}"
+  if ! curl --fail --silent --show-error --location "${PUBLIC_STATUS_URL}/legal/${path}" -o "$TMP_CURL_BODY"; then
+    echo "Post-deploy verification failed: ${PUBLIC_STATUS_URL}/legal/${path} (HTTP error)" >&2
+    exit 1
+  fi
+  if ! grep -qF "${marker}" "$TMP_CURL_BODY"; then
+    echo "Post-deploy verification failed: ${PUBLIC_STATUS_URL}/legal/${path} (expected '${marker}')" >&2
+    exit 1
+  fi
+done
+printf 'Legal pages deployed to status.sami/legal.\n'

dashcaddy-api/scripts/test-legal-pages.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TERMS="$ROOT/status/legal/terms/index.html"
+PRIVACY="$ROOT/status/legal/privacy/index.html"
+TOS_ALIAS="$ROOT/status/legal/tos/index.html"
+require() { grep -Eqi "$2" "$1" || { echo "Missing required content in $1: $2" >&2; exit 1; }; }
+test -s "$TERMS" && test -s "$PRIVACY" && test -s "$TOS_ALIAS"
+for section in 'License grant' 'Acceptable use' 'best-effort' 'Refund policy' 'Termination' 'Limitation of liability' 'Governing law'; do require "$TERMS" "$section"; done
+require "$TERMS" 'within 14 calendar days'
+for section in 'GDPR' 'lawful bases' 'Stripe' 'Tailscale' 'data portability|portability' '30 days after cancellation' 'privacy@sami-ahmed.net'; do require "$PRIVACY" "$section"; done
+# Reject any SOC 2 / HIPAA compliance claims (the launch explicitly excludes them).
+# Negated `! grep` does not trigger errexit under `set -e` (ShellCheck SC2251), so use an
+# explicit if/then to make the forbidden-claim guard actually fail the script.
+# Regex covers: SOC 2 / SOC-2 / SOC2 + (certified|compliant|compliance|compliant),
+# HIPAA + (certified|compliant|compliance|compliant), with optional hyphen.
+if grep -Eqi 'SOC[ -]?2[[:space:]-]+(certified|compliant|compliance)|HIPAA[[:space:]-]+(certified|compliant|compliance)' "$TERMS" "$PRIVACY"; then
+  echo "Forbidden SOC 2/HIPAA compliance language detected in Terms or Privacy pages." >&2
+  exit 1
+fi
+require "$ROOT/status/index.html" 'href="/legal/terms"'
+require "$ROOT/status/index.html" 'href="/legal/privacy"'
+require "$TOS_ALIAS" 'url=/legal/terms'
+echo 'Legal page sanity checks passed.'

dashcaddy-api/src/recipes/bundled-workflows.js

@@ -45,7 +45,12 @@ const BUNDLED_WORKFLOWS = {
     interval: 15 * 60 * 1000, // 15 minutes
     actions: [
       { type: 'health-check', target: '{{serviceId}}' },
-      { type: 'notify-on-failure', message: 'Health check failed for {{serviceId}}' }
+      // failingServices is set by healthCheckService when it throws (any
+      // service failed). It's a comma-joined string of failing service IDs.
+      // Previously this used {{serviceId}} which never resolved because
+      // no per-service ID is in scope at the workflow level — that's the
+      // DC-044 root-cause bug fix.
+      { type: 'notify-on-failure', message: 'Health check failed for {{failingServices}}' }
     ]
   },
   'disk-space-alert': {
@@ -194,34 +199,23 @@ class WorkflowEngine extends EventEmitter {
     if (!workflow) {
       throw new Error(`Unknown workflow: ${workflowId}`);
     }
-    
+
     if (!this.enabled.get(workflowId)) {
       console.log(`[WorkflowEngine] Workflow ${workflowId} is disabled, skipping`);
       return { skipped: true, reason: 'disabled' };
     }
-    
+
     const executionId = `${workflowId}-${Date.now()}`;
     const startTime = Date.now();
-    
+
     console.log(`[WorkflowEngine] Executing workflow: ${workflowId}`);
     this.emit('workflow-start', { workflowId, executionId, triggerData });
-    
+
-    const results = [];
+    const results = await this._runActions(workflow.actions, triggerData);
-    
+
-    for (const action of workflow.actions) {
-      try {
-        const result = await this.executeAction(action, triggerData);
-        results.push({ action: action.type, success: true, result });
-      } catch (error) {
-        console.error(`[WorkflowEngine] Action ${action.type} failed:`, error.message);
-        results.push({ action: action.type, success: false, error: error.message });
-        // Continue with other actions but log failure
-      }
-    }
-    
     const duration = Date.now() - startTime;
     const allSucceeded = results.every(r => r.success);
-    
+
     const historyEntry = {
       executionId,
       workflowId,
@@ -232,22 +226,63 @@ class WorkflowEngine extends EventEmitter {
       success: allSucceeded,
       results
     };
-    
+
     this.history.push(historyEntry);
-    
+
     // Keep history to last 500 entries
     if (this.history.length > 500) {
       this.history = this.history.slice(-500);
     }
-    
+
     this.saveHistory();
-    
+
     this.emit('workflow-complete', historyEntry);
     console.log(`[WorkflowEngine] Workflow ${workflowId} completed in ${duration}ms, success: ${allSucceeded}`);
-    
+
     return historyEntry;
   }
 
+  /**
+   * Run a sequence of actions and collect their results. Extracted from
+   * executeWorkflow so the per-action result threading (notify-on-failure
+   * gating) and the failingServices context surface can be unit-tested
+   * directly. executeWorkflow() is the production entry point; _runActions
+   * is an internal helper that callers shouldn't reach for.
+   */
+  async _runActions(actions, triggerData = {}) {
+    const results = [];
+
+    for (let i = 0; i < actions.length; i++) {
+      const action = actions[i];
+      const previousResult = i > 0 ? results[i - 1] : null;
+      // notify-on-failure needs to see the previous action's outcome to decide
+      // whether to fire. Passing the full results array in the trigger data lets
+      // executeAction do that lookup without changing the action shape.
+      // Also surface failingServices (set by healthCheckService on throw) so
+      // template variables like {{failingServices}} can interpolate.
+      const actionContext = {
+        ...triggerData,
+        previousResult,
+        failingServices: previousResult && previousResult.failingServices ? previousResult.failingServices : undefined,
+      };
+      try {
+        const result = await this.executeAction(action, actionContext);
+        results.push({ action: action.type, success: true, result });
+      } catch (error) {
+        console.error(`[WorkflowEngine] Action ${action.type} failed:`, error.message);
+        results.push({
+          action: action.type,
+          success: false,
+          error: error.message,
+          failingServices: error.failingServices,
+        });
+        // Continue with other actions but log failure
+      }
+    }
+
+    return results;
+  }
+
   /**
    * Execute a single action
    */
@@ -269,7 +304,12 @@ class WorkflowEngine extends EventEmitter {
         );
       
       case 'notify-on-failure':
-        // Only send if previous action failed
+        // Only send if previous action failed (success: false). The
+        // previousResult is injected by executeWorkflow's loop. If there
+        // was no previous action, this is a no-op (returns skipped).
+        if (!context.previousResult || context.previousResult.success !== false) {
+          return { skipped: true, reason: 'no previous failure' };
+        }
         return this.notify(
           this.interpolate(action.message, context),
           action.channel
@@ -323,11 +363,31 @@ class WorkflowEngine extends EventEmitter {
           }
         }
       }
-      return { checked: results.length, healthy: results.filter(r => r.healthy).length, results };
+      // Surface failing service IDs so downstream notify-on-failure actions
+      // can interpolate `{{failingServices}}` into the alert message. Without
+      // this, templates like `Health check failed for {{serviceId}}` stay
+      // literal because there's no serviceId in scope.
+      const failing = results.filter(r => !r.healthy).map(r => r.service);
+      const healthy = results.filter(r => r.healthy).length;
+      const result = { checked: results.length, healthy, results, failing };
+      if (failing.length > 0) {
+        // Throw so the action's success:false path is taken and notify-on-failure fires.
+        const err = new Error(`Health check failed for ${failing.length} service(s): ${failing.join(', ')}`);
+        err.failingServices = failing;
+        err.workflowResult = result;
+        throw err;
+      }
+      return result;
     }
-    
+
     // Single service check
     const healthy = await this.checkContainerHealth(serviceId);
+    if (!healthy) {
+      const err = new Error(`Health check failed for ${serviceId}`);
+      err.failingServices = [serviceId];
+      err.workflowResult = { serviceId, healthy };
+      throw err;
+    }
     return { serviceId, healthy };
   }
 
@@ -338,10 +398,18 @@ class WorkflowEngine extends EventEmitter {
     try {
       const docker = this.ctx.docker?.client;
       if (!docker) return false;
-      
+
       const container = docker.getContainer(containerId);
       const info = await container.inspect();
-      return info.State && info.State.Running && info.State.Health !== 'unhealthy';
+      // A container is healthy if it's running AND (it has no explicit
+      // health check OR its health check reports healthy/starting).
+      // info.State.Health is undefined when no HEALTHCHECK is declared.
+      // info.State.Health.Status is 'starting' | 'healthy' | 'unhealthy'
+      // when the health check IS declared.
+      if (!info.State || !info.State.Running) return false;
+      if (!info.State.Health) return true;  // no health check defined → running = healthy
+      const status = info.State.Health.Status;
+      return status === 'healthy' || status === 'starting';
     } catch (error) {
       return false;
     }

dashcaddy-api/src/utilities/middleware.js

@@ -402,9 +402,14 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/share/:token/preview',           exact: true,  method: 'GET' },
     { path: '/api/v1/share/:token/subscribe',         exact: true,  method: 'POST' },
     { path: '/api/v1/share/:token/redeem-tailscale',  exact: true,  method: 'POST' },
-    // /me and /admin/* require authentication — NOT public. Listed here
+    { path: '/api/v1/billing/checkout',              exact: true,  method: 'POST' },
-    // only to document them; absence from PUBLIC_ROUTES means they go
+    // /api/v1/billing/webhook was REMOVED: webhooks are handled out-of-process
-    // through the normal auth gate. CSRF applies to writes as usual.
+    // by scripts/stripe-license-bridge.js (the merchant webhook secret never
+    // enters the API process). The PUBLIC_ROUTES allowlist drift test would
+    // catch any re-add of this dead entry.
+    // /api/v1/services + status: read-only service metadata that the public
+    // dashboard needs before login (services list widget, status pill).
+    // Writes go through the normal auth gate. CSRF applies to writes as usual.
     { path: '/api/v1/services',          exact: true,  method: 'GET' },
     { path: '/api/v1/ca/info',           exact: true,  method: 'GET' },
     { path: '/api/v1/ca/root.crt',       exact: true,  method: 'GET' },

status/css/dashboard.css

@@ -3852,6 +3852,7 @@ button:focus-visible {
   display: flex;
   align-items: center;
   justify-content: center;
+  flex-wrap: wrap;
   gap: 14px;
   padding: 40px 0 20px;
   margin-top: 48px;
@@ -3873,3 +3874,7 @@ button:focus-visible {
   height: 140px;
   width: auto;
 }
+
+.footer-legal { display: flex; gap: 14px; font-size: 0.8rem; }
+.footer-legal a { color: var(--muted); text-decoration: none; }
+.footer-legal a:hover, .footer-legal a:focus-visible { color: var(--accent); text-decoration: underline; }

status/index.html

@@ -939,6 +939,10 @@
   <footer class="dashcaddy-footer">
     <span class="footer-copy">&copy; <span id="footer-year"></span></span>
     <img src="/assets/sami7777-logo.png" alt="samiahmed7777" class="footer-logo">
+    <nav class="footer-legal" aria-label="Legal">
+      <a href="/legal/terms">Terms of Service</a>
+      <a href="/legal/privacy">Privacy Policy</a>
+    </nav>
   </footer>
 
   <!-- xterm.js for container exec/shell -->

status/legal/privacy/index.html

@@ -0,0 +1,12 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Privacy Policy | DashCaddy</title><style>:root{color-scheme:dark;--card:#111c2e;--text:#e8edf5;--muted:#aab7ca;--accent:#68a4ff;--border:#263750}*{box-sizing:border-box}body{margin:0;background:linear-gradient(145deg,#07101d,#101b31);color:var(--text);font:16px/1.7 system-ui,sans-serif}main{width:min(900px,calc(100% - 32px));margin:48px auto;padding:clamp(24px,5vw,56px);background:var(--card);border:1px solid var(--border);border-radius:18px}h1{margin:0;font-size:clamp(2rem,5vw,3rem)}h2{margin-top:2rem;color:#fff}h3,strong{color:var(--text)}p,li{color:var(--muted)}a{color:var(--accent)}.eyebrow{color:var(--accent);font-weight:700;text-transform:uppercase}.notice{border-left:3px solid var(--accent);background:#0b1628;padding:12px 16px}footer{margin-top:42px;padding-top:22px;border-top:1px solid var(--border);display:flex;flex-wrap:wrap;gap:20px}</style></head><body><main><div class="eyebrow">DashCaddy Legal</div><h1>Privacy Policy</h1><p><strong>Effective and last updated:</strong> July 31, 2026</p><p class="notice">This GDPR-aware policy describes DashCaddy v1.0. It is not legal advice and may be refined following professional review.</p>
+<h2>1. Controller and contact</h2><p>Sami Ahmed, operator of DashCaddy, controls personal data collected for subscriptions, licensing, and operation. Contact <a href="mailto:privacy@sami-ahmed.net">privacy@sami-ahmed.net</a>. DashCaddy has no separate Data Protection Officer; this is the privacy contact.</p>
+<h2>2. Data collected</h2><h3>Account, login, and billing</h3><ul><li>Email address for login, license delivery, support, billing, and essential notices.</li><li>Subscription status, Stripe customer/session IDs, product, payment status, dates, and refunds. <strong>We do not receive or store full card numbers or security codes.</strong></li></ul><h3>License and server metadata</h3><ul><li>License key, tier, activation/expiry dates, and machine/host metadata embedded in or associated with the license.</li><li>Connection metadata needed to validate and secure licenses, such as IP address, timestamp, host/machine identifier, version, and request outcome.</li><li>The key containing machine metadata is stored locally in <code>data/credentials.json</code> and on the operator’s license server.</li></ul><h3>Optional Tailscale data</h3><p>Only if enabled, DashCaddy sends coordination API requests and may process Tailscale device IDs, tailnet/user IDs, names/status, and minted device or pre-auth keys. Keys are stored only as needed for the configured integration or share flow. Tailscale independently processes data under its terms.</p><h3>Support</h3><p>We collect messages and diagnostics you voluntarily provide. Do not send passwords, private keys, or unrelated personal data.</p>
+<h2>3. Data not intentionally collected</h2><p>The hosted licensing service does not intentionally collect proxied content, DNS query history, injected credentials, or card details. Credentials and local configuration remain customer-controlled unless deliberately provided for support. v1.0 makes no automated decisions with legal or similarly significant effects.</p>
+<h2>4. Purposes and GDPR lawful bases</h2><ul><li><strong>Contract:</strong> licenses, authentication, optional features, billing/refunds, and support.</li><li><strong>Legitimate interests:</strong> per-host enforcement, fraud/abuse prevention, security, troubleshooting, and proportionate product improvement.</li><li><strong>Legal obligation:</strong> required transaction/tax records and valid legal requests.</li><li><strong>Consent:</strong> optional marketing and integrations where consent is appropriate. Consent may be withdrawn without affecting earlier lawful processing.</li></ul>
+<h2>5. Sharing and processors</h2><p>We do not sell personal data. Necessary disclosures are to:</p><ul><li><strong>Stripe</strong> for Checkout, billing, fraud prevention, receipts, and refunds. Card data goes directly to Stripe.</li><li><strong>Tailscale</strong> only when you configure/use the integration, for coordination and device/key operations.</li><li><strong>Our email delivery provider</strong> for login, license, billing, security, and support email; it receives the address and message content.</li></ul><p>We may disclose data when legally required, to protect rights/safety, or in a business transfer with safeguards. We do not otherwise share personal data except as described in this policy.</p>
+<h2>6. International transfers</h2><p>Processors may handle data outside your country. Where GDPR applies, we will use a legally recognized transfer mechanism where one is required, such as an adequacy decision or Standard Contractual Clauses. Contact us for information about safeguards applicable to your data.</p>
+<h2>7. Retention</h2><ul><li><strong>License keys and host metadata:</strong> life of subscription plus 30 days after cancellation, then deleted or irreversibly anonymized unless law requires longer.</li><li><strong>Billing records:</strong> as required for tax, accounting, chargebacks, and fraud prevention.</li><li><strong>Connection/security logs:</strong> normally no more than 30 days unless an incident requires preservation.</li><li><strong>Support records:</strong> while active and normally up to 12 months afterward.</li><li><strong>Optional Tailscale keys:</strong> until expired, used/revoked, share removal, or integration disablement, subject to Tailscale retention.</li></ul><p>Backups may retain deleted data for a limited rotation and are restored only for disaster recovery.</p>
+<h2>8. Security</h2><p>We use reasonable safeguards and data minimization, but no system is completely secure. DashCaddy does not claim SOC 2, HIPAA, PCI-DSS, or another audited certification. Stripe Checkout processes cards; card data never touches DashCaddy servers.</p>
+<h2>9. GDPR and other privacy rights</h2><p>Depending on location, you may request access, correction, deletion, restriction, objection, withdrawal of consent, and data portability in a structured machine-readable format, and complain to your supervisory authority. Email <a href="mailto:privacy@sami-ahmed.net">privacy@sami-ahmed.net</a> with “Privacy Request.” We may verify identity. We aim to respond within 30 days (one month), explain lawful extensions/refusals, and normally charge no fee. Without a central account, we search using identifiers you provide.</p>
+<h2>10. Children, cookies, and marketing</h2><p>DashCaddy is not directed to children under 16. Checkout/login may use strictly necessary cookies. We request consent before non-essential analytics/marketing cookies where required. Marketing email is optional and includes unsubscribe.</p>
+<h2>11. Changes and contact</h2><p>Revisions will show a new date, with reasonable notice for material changes. Questions and rights requests: <a href="mailto:privacy@sami-ahmed.net">privacy@sami-ahmed.net</a>.</p><footer><a href="/legal/terms">Terms of Service</a><a href="mailto:privacy@sami-ahmed.net">Contact</a><a href="/">Back to DashCaddy</a></footer></main></body></html>

status/legal/terms/index.html

@@ -0,0 +1,13 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Terms of Service | DashCaddy</title><style>:root{color-scheme:dark;--bg:#09111f;--card:#111c2e;--text:#e8edf5;--muted:#aab7ca;--accent:#68a4ff;--border:#263750}*{box-sizing:border-box}body{margin:0;background:linear-gradient(145deg,#07101d,#101b31);color:var(--text);font:16px/1.7 system-ui,sans-serif}main{width:min(900px,calc(100% - 32px));margin:48px auto;padding:clamp(24px,5vw,56px);background:var(--card);border:1px solid var(--border);border-radius:18px}h1{margin:0;font-size:clamp(2rem,5vw,3rem)}h2{margin-top:2rem;color:#fff}p,li{color:var(--muted)}strong{color:var(--text)}a{color:var(--accent)}.eyebrow{color:var(--accent);font-weight:700;text-transform:uppercase}.notice{border-left:3px solid var(--accent);background:#0b1628;padding:12px 16px}footer{margin-top:42px;padding-top:22px;border-top:1px solid var(--border);display:flex;flex-wrap:wrap;gap:20px}</style></head><body><main><div class="eyebrow">DashCaddy Legal</div><h1>Terms of Service</h1><p><strong>Effective and last updated:</strong> July 31, 2026</p><p class="notice">These Terms are a general launch document and are not legal advice. The operator may revise them following professional legal review.</p>
+<h2>1. Agreement and operator</h2><p>These Terms govern your purchase, installation, and use of DashCaddy software and related hosted licensing services (the “Service”), operated by Sami Ahmed (“DashCaddy,” “we,” “us,” or “our”). By purchasing, activating, or using DashCaddy, you agree to these Terms and the <a href="/legal/privacy">Privacy Policy</a>. If acting for an organization, you represent that you can bind it.</p>
+<h2>2. License grant</h2><p>Subject to payment and these Terms, we grant a limited, revocable, non-exclusive, non-sublicensable, non-transferable license to install and use DashCaddy on <strong>one host per license</strong> for the subscription term. A license may be moved to a replacement host with approval, but not shared, resold, rented, or used concurrently on multiple hosts. DashCaddy retains all ownership and intellectual-property rights.</p><p>The license key embeds or is associated with machine metadata. A copy is stored on the licensed host in <code>data/credentials.json</code> and on our license server for validation and enforcement.</p>
+<h2>3. Acceptable use</h2><p>You must use DashCaddy lawfully and are responsible for connected systems. You must not:</p><ul><li>use proxy, DNS, credential-injection, sharing, or Tailscale features for unauthorized access, traffic interception, evasion, malware, spam, phishing, or attacks;</li><li>overload, bypass, or interfere with the Service, licensing, authentication, or security;</li><li>reverse engineer or modify DashCaddy except where law expressly permits, or remove notices;</li><li>violate privacy, intellectual-property, sanctions, export-control, or other applicable law; or</li><li>provide data or credentials you lack authority to process.</li></ul><p>We may investigate abuse and suspend access when reasonably necessary to protect users, third parties, or the Service.</p>
+<h2>4. Availability and changes</h2><p>DashCaddy v1.0 is provided on a <strong>best-effort basis with no service-level agreement (SLA)</strong>, uptime guarantee, or guaranteed response time. Maintenance, failures, third-party outages, security events, and product changes may interrupt availability. Features may change or be discontinued with reasonable notice where practical.</p>
+<h2>5. Billing, renewal, and Refund policy</h2><p>Prices, billing periods, taxes, and renewal terms appear at checkout. Stripe processes payments; card details go directly to Stripe and never touch DashCaddy servers. Unless checkout states otherwise, subscriptions renew automatically until cancelled.</p><p><strong>Refund policy:</strong> request a pro-rated refund within 14 calendar days after initial purchase. It covers the unused portion of that initial period from the request date. After 14 days, and for renewals, payments are non-refundable except where law requires. Cancellation prevents renewal but does not itself create a refund.</p>
+<h2>6. Your systems and data</h2><p>You are responsible for backups, configuration, access control, and host security. DashCaddy manages sensitive proxy, DNS, and credential-injection settings; review changes. Data handling is described in the <a href="/legal/privacy">Privacy Policy</a>.</p>
+<h2>7. Suspension and Termination</h2><p>You may stop using DashCaddy and cancel renewal anytime. We may suspend or terminate for material breach, non-payment, unlawful or abusive use, or security risk, with notice and opportunity to cure where reasonably possible. On termination the license ends. Ownership, disclaimers, liability, and governing-law provisions survive.</p>
+<h2>8. Disclaimers</h2><p>To the maximum extent permitted by law, the Service is “as is” and “as available.” We disclaim implied warranties of merchantability, fitness, non-infringement, and uninterrupted or error-free operation. DashCaddy is not represented as certified for regulated workloads and makes no SOC 2, HIPAA, or similar compliance claim. Mandatory rights remain unaffected.</p>
+<h2>9. Limitation of liability</h2><p>To the maximum extent permitted by law, DashCaddy and its operator are not liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenue, data, goodwill, or business interruption. Aggregate liability will not exceed amounts paid for DashCaddy in the 12 months before the claim. Limits do not apply where prohibited or to liability that cannot lawfully be limited.</p>
+<h2>10. Indemnity</h2><p>Where permitted, you will indemnify us against third-party claims from your unlawful use, connected services or data, or breach, except to the extent caused by our unlawful conduct.</p>
+<h2>11. Governing law and disputes</h2><p>These Terms are governed by laws applicable in the operator’s principal place of business, without conflict-of-law rules. Courts there have jurisdiction, except consumers retain mandatory rights and forum protections in their country. Before filing, parties will attempt resolution by email for 30 days.</p>
+<h2>12. Changes and contact</h2><p>Material changes will be posted with a new effective date and reasonable advance notice where practical. Questions, cancellation, or refunds: <a href="mailto:privacy@sami-ahmed.net">privacy@sami-ahmed.net</a>.</p><footer><a href="/legal/privacy">Privacy Policy</a><a href="mailto:privacy@sami-ahmed.net">Contact</a><a href="/">Back to DashCaddy</a></footer></main></body></html>

status/legal/tos/index.html

@@ -0,0 +1 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="refresh" content="0;url=/legal/terms"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="canonical" href="/legal/terms"><title>Terms of Service | DashCaddy</title></head><body><p>DashCaddy Legal: Continue to the <a href="/legal/terms">Terms of Service</a>.</p></body></html>